SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

exec: introduce PrivateDevices= switch to provide services with a private /dev

Browse Source 
Similar to PrivateNetwork=, PrivateTmp= introduce PrivateDevices= that
sets up a private /dev with only the API pseudo-devices like /dev/null,
/dev/zero, /dev/random, but not any physical devices in them.
This commit is contained in:
Lennart Poettering
2014-01-20 21:28:37 +01:00
parent 3540c7f88f
commit 7f112f50fe
13 changed files with 140 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/execute.c
+5 -1
View File
@@ -1427,7 +1427,8 @@ int exec_spawn(ExecCommand *command,
!strv_isempty(context->read_only_dirs) ||
!strv_isempty(context->inaccessible_dirs) ||
context->mount_flags != 0 ||
(context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir))) {
(context->private_tmp && runtime && (runtime->tmp_dir || runtime->var_tmp_dir)) ||
context->private_devices) {
char *tmp = NULL, *var = NULL;
@@ -1450,6 +1451,7 @@ int exec_spawn(ExecCommand *command,
context->inaccessible_dirs,
tmp,
var,
context->private_devices,
context->mount_flags);
if (err < 0) {
@@ -1896,6 +1898,7 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
"%sNonBlocking: %s\n"
"%sPrivateTmp: %s\n"
"%sPrivateNetwork: %s\n"
"%sPrivateDevices: %s\n"
"%sIgnoreSIGPIPE: %s\n",
prefix, c->umask,
prefix, c->working_directory ? c->working_directory : "/",
@@ -1903,6 +1906,7 @@ void exec_context_dump(ExecContext *c, FILE* f, const char *prefix) {
prefix, yes_no(c->non_blocking),
prefix, yes_no(c->private_tmp),
prefix, yes_no(c->private_network),
prefix, yes_no(c->private_devices),
prefix, yes_no(c->ignore_sigpipe));
STRV_FOREACH(e, c->environment)